build.gradle

import com.github.benmanes.gradle.versions.updates.DependencyUpdatesTask
import com.github.spotbugs.snom.SpotBugsTask

plugins {
    id "build-dashboard" // See build/reports/buildDashboard/index.html
    // TODO: project-report is presently broken because of pitest task
    id "project-report" // Try the `projectReport` task
    id "com.dorongold.task-tree"
    id "com.github.ben-manes.versions" // Try the dependencyUpdates task
    id "java" // Gradle support for Java
    id "org.unbroken-dome.test-sets" // Alternative roots such an integration tests
    id "checkstyle" // To check that code follow style standards
    id "pmd" // Static analysis based on source (does not check compiled code)
    id "com.github.spotbugs" // Static analysis based on compiled code (does not check source)
    id "com.github.andygoossens.gradle-modernizer-plugin"
    id "jacoco" // To run test coverage
    id "info.solidsoft.pitest" // To run mutation testing
    id "org.kordamp.gradle.jdeps"
    id "org.owasp.dependencycheck" // To push security to the left
    id "application" // To build the executable jar
}

version = "0-SNAPSHOT"
group = "demo"

repositories {
    mavenCentral()
}

dependencies {
    compileOnly "org.projectlombok:lombok:$lombokVersion"
    annotationProcessor "org.projectlombok:lombok:$lombokVersion"
    compileOnly "com.github.spotbugs:spotbugs-annotations:$spotbugsVersion"
    compileOnly "com.google.code.findbugs:findbugs-annotations:$findbugsAnnotationsVersion"
    compileOnly "org.gaul:modernizer-maven-annotations:$modernizerVersion"

    testCompileOnly "org.projectlombok:lombok:$lombokVersion"
    testAnnotationProcessor "org.projectlombok:lombok:$lombokVersion"
    testCompileOnly "com.google.code.findbugs:findbugs-annotations:$findbugsAnnotationsVersion"

    testImplementation "org.junit.jupiter:junit-jupiter:$junitVersion"
    testImplementation "org.assertj:assertj-core:$assertJVersion"
    testImplementation "org.mockito:mockito-inline:$mockitoVersion"
    testImplementation "com.github.stefanbirkner:system-lambda:$systemLambdaVersion"

    // Quiet build -- build works without this, but JUnit complains
    testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:$junitVersion"

    spotbugsPlugins "com.h3xstream.findsecbugs:findsecbugs-plugin:$findsecbugsPluginVersion"

    constraints {
        implementation("org.apache.logging.log4j:log4j-core") {
            version {
                strictly("[2.16, 3[")
                prefer("2.16.0")
            }
            because("CVE-2021-44228: Log4j vulnerable to remote code execution")
        }
    }
}

// TODO: Work around GitHub issue #92
configurations.modernizer {
    exclude group: "org.codehaus.plexus", module: "plexus-utils"
}

// TODO: Work around GitHub issue #54
configurations.pmd {
    resolutionStrategy {
        forcedModules = ["commons-io:commons-io:2.8.0"]
    }
}

java {
    toolchain {
        languageVersion.set(JavaLanguageVersion.of("$jdkVersion"))
    }
}

tasks.withType(JavaCompile) {
    options.compilerArgs += ["-Werror", "-Xlint:all,-processing", "-parameters"]
}

test {
    // NB -- JaCoCo draws from _unit tests_, not integration tests
    // When tests fail, you still have a coverage report
    finalizedBy jacocoTestReport
}

tasks.withType(Test) {
    // Quieter builds when JUL is in use (you or another library or tool)
    // TODO: Keep builds noisy in CI
    systemProperty "java.util.logging.config.file",
            "$projectDir/config/logging.properties"
}

testSets {
    integrationTest
}

tasks.withType(Test) {
    // This idiom ensures JUnit5 for integration tests, not just unit tests
    useJUnitPlatform()
}

checkstyle {
    toolVersion = checkstyleVersion
    // default checkstyle config
    configFile = project(":").file("config/checkstyle/checkstyle.xml")
    // google style
    // configFile = project(":").file("config/checkstyle/google_checks.xml")
    // sun style
    // configFile = project(":").file("config/checkstyle/sun_checks.xml")
}

pmd {
    ignoreFailures = false
    // TODO: targetJdk = 11 -- there is no defined constant for this
    toolVersion = pmdVersion
}

spotbugs {
    effort = "Max"
    reportLevel = "Low"
    toolVersion = spotbugsVersion
}

tasks.withType(SpotBugsTask) {
    reports {
        html {
            enabled = true
        }
        xml {
            enabled = true
        }
    }
}

modernizer {
    failOnViolations = true
    includeTestClasses = true
    javaVersion = "$jdkVersion"
}

jacoco {
    toolVersion = jacocoVersion
}

jacocoTestReport {
    dependsOn test
}

jacocoTestCoverageVerification {
    violationRules {
        rule {
            limit {
                minimum = 1.00
            }
        }
    }
}

pitest {
    junit5PluginVersion = pitestJUnit5PluginVersion
    mutationThreshold = 100
    // Cannot name this "pitestVersion" -- the plugin has a property of the same
    // name, so this property needs to have a distinct name to satisfy Gradle
    pitestVersion = "$pitestToolVersion"
    timestampedReports = false
    verbose = true
}

tasks.named("pitest") { // PITest plugin does not expose task as expected
    dependsOn jacocoTestCoverageVerification
}

jdepsReport {
    // TODO: Report shows a big mess with dependencies
    // TODO: Why mess with multi-release jars?
    multiReleaseJars = [".*": "$jdkVersion"]
}

dependencyCheck {
    failBuildOnCVSS = 0
    skip = Boolean.getBoolean("owasp.skip")
    // Use this block when mirroring the NIST CVE data
    cve {
        urlBase = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz"
        // urlBase = "file:///PATH/TO/mirror/nvdcve-1.1-%d.json.gz"
        urlModified = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz"
        // urlModified = "file:///PATH/TO/mirror/nvdcve-1.1-modified.json.gz"
    }
}

jar {
    manifest {
        attributes 'Main-Class': "$mainClass"
        attributes 'Add-Opens': 'java.base/java.lang java.base/java.util java.base/java.lang.reflect'
    }
}

check {
    dependsOn += jacocoTestCoverageVerification
    dependsOn += "pitest"
    dependsOn += integrationTest
    dependsOn += dependencyCheckAnalyze
}

tasks.withType(DependencyUpdatesTask) {
    rejectVersionIf {
        !isStable(it.candidate.version) && isStable(it.currentVersion)
    }
}

wrapper {
    gradleVersion = gradleWrapperVersion
    distributionType = "ALL"
}

static def isStable(version) {
    def stableKeyword = ["RELEASE", "FINAL", "GA"].any {
        version.toUpperCase().contains(it)
    }
    def otherReleasePattern = version ==~ '^[0-9,.v-]+(-r)?$'

    return stableKeyword || otherReleasePattern
}